Cloudflare fixes CDN code execution bug affecting 12.7% of all sites

guest · Jul 16, 2021

Cloudflare fixes CDN code execution bug affecting 12.7% of all sites
July 16, 2021
https://www.bleepingcomputer.com/ne...ution-bug-affecting-127-percent-of-all-sites/

Cloudflare has fixed a critical vulnerability in its free and open-source CDNJS potentially impacting 12.7% of all websites on the internet.

CDNJS serves millions of websites with over 4,000 JavaScript and CSS libraries stored publicly on GitHub, making it the second-largest JavaScript CDN.
The vulnerability exploits comprised publishing packages to Cloudflare's CDNJS using GitHub and npm, to trigger a Path Traversal vulnerability, and eventually remote code execution.

If exploited, the vulnerability would lead to a complete compromise of CDNJS infrastructure.
Click to expand...

Cloudflare issues many fixes to squash the bug
The researcher reported this vulnerability to Cloudflare via HackerOne's vulnerability disclosure program on April 6th, 2021, and saw Cloudflare's team applying an intermittent fix within hours.

The initial fix seen by BleepingComputer is aimed at resolving the symlink vulnerability: [...]
RyotaK shared with BleepingComputer that while the first fix was centered around rejecting symbolic links (symlinks) in Git repositories, it only remediated a part of the problem.

"Given that there are many vulnerabilities in the supply chain, which are easy to exploit but have a large impact, I feel that it's very scary," says RyotaK in his blog post.
Click to expand...

Log in or Sign up

Cloudflare fixes CDN code execution bug affecting 12.7% of all sites

guest Guest

Log in or Sign up

Cloudflare fixes CDN code execution bug affecting 12.7% of all sites

guest Guest

Useful Searches